ci: publish aarch64 pacman package artifacts

.gitea/workflows/ci.yml

@@ -109,6 +109,36 @@ jobs:
           cp "$BIN" souveraine-aarch64
           sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
 
+      - name: Package aarch64 pacman artifact
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/src/Souveraine"
+          PKGVER="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
+          WORK="$GITHUB_WORKSPACE/pacman-package"
+          REPO="$GITHUB_WORKSPACE/pacman-repo"
+          rm -rf "$WORK" "$REPO"
+          mkdir -p "$WORK" "$REPO"
+          cp souveraine-aarch64 packaging/souveraine.service LICENSE "$WORK/"
+          cp packaging/arch/PKGBUILD.prebuilt "$WORK/PKGBUILD"
+          (
+            cd "$WORK"
+            export SOUVERAINE_PKGVER="$PKGVER"
+            # The payload was cross-compiled above; tell makepkg to label the
+            # archive for that payload, not for this x86_64 runner host.
+            CARCH=aarch64 makepkg --nodeps --noconfirm --cleanbuild
+          )
+          PKG=$(find "$WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
+          test -n "$PKG"
+          bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
+          cp "$PKG" "$REPO/"
+          repo-add "$REPO/souveraine.db.tar.zst" "$REPO/$(basename "$PKG")"
+          # Pacman requests <repo>.db; release assets cannot preserve the
+          # symlink repo-add normally creates, so replace it with a real copy.
+          rm -f "$REPO/souveraine.db"
+          cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
+          sha256sum "$REPO/$(basename "$PKG")" "$REPO/souveraine.db" \
+            > "$REPO/souveraine-repo.sha256"
+
       - name: Publish rolling edge prerelease
         run: |
           set -euo pipefail
@@ -131,12 +161,13 @@ jobs:
             -d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
             | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
 
-          for f in souveraine-aarch64 souveraine-aarch64.sha256; do
+          for f in souveraine-aarch64 souveraine-aarch64.sha256 \
+            "$GITHUB_WORKSPACE"/pacman-repo/*; do
             curl -sf -X POST -H "$AUTH" \
-              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=${f}" \
+              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \
               -F "attachment=@${f}" -o /dev/null
           done
-          echo "published edge (${DESC})"
+          echo "published edge (${DESC}) with aarch64 package + pacman database"
 
   # Mirror the published branch only. primary (dev) never reaches Codeberg.
   sync-codeberg: